PoC Exploit Publicly Disclosed: Windows ‘libarchive’ Flaw Leaks NetNTLMv2 Hashes

Security researchers disclosed CVE-2025-59284 in Windows' libarchive handling: a specially crafted tar with hardlinks can force the OS to resolve a UNC path during archive extraction or file open, causing NetNTLMv2 authentication requests to be sent to attacker-controlled servers and leaking hashes; a public PoC exists and Microsoft’s patch currently displays a warning dialog that may not prevent exploitation if users accept it.